CVE-2024-40992 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341
https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996
https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636
https://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40992-6554@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40992
https://www.cve.org/CVERecord?id=CVE-2024-40992

History

Thu, 12 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:37:35.800Z

Updated: 2024-11-05T09:34:39.217Z

Reserved: 2024-07-12T12:17:45.605Z

Link: CVE-2024-40992

Vulnrichment

Updated: 2024-08-02T04:39:56.166Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:20.497

Modified: 2024-07-12T16:34:58.687

Link: CVE-2024-40992

Redhat

Severity : Low

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40992 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40992", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:35.800Z", "dateUpdated": "2024-11-05T09:34:39.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:34:39.217Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "689c5421bfe0", "lessThan": "163868ec1f6c", "status": "affected", "versionType": "git"}, {"version": "689c5421bfe0", "lessThan": "943c94f41dfe", "status": "affected", "versionType": "git"}, {"version": "689c5421bfe0", "lessThan": "f67ac0061c76", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.36", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "title": "RDMA/rxe: Fix responder length checking for UD request packets", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.166Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:44.819044Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:56.166Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:01:44.819044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.062Z"}}], "cna": {"title": "RDMA/rxe: Fix responder length checking for UD request packets", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "689c5421bfe0", "lessThan": "163868ec1f6c", "versionType": "git"}, {"status": "affected", "version": "689c5421bfe0", "lessThan": "943c94f41dfe", "versionType": "git"}, {"status": "affected", "version": "689c5421bfe0", "lessThan": "f67ac0061c76", "versionType": "git"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"status": "unaffected", "version": "0", "lessThan": "6.2", "versionType": "custom"}, {"status": "unaffected", "version": "6.6.36", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.7", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_resp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:52:57.195Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40992", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:20.142Z", "dateReserved": "2024-07-12T12:17:45.605Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:37:35.800Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix responder length checking for UD request packets\n\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\n\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\n\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: corrige la comprobaci\u00f3n de la longitud del respondedor para los paquetes de solicitud UD. Seg\u00fan la especificaci\u00f3n IBA: si se detecta un paquete de solicitud UD con una longitud no v\u00e1lida, la solicitud ser\u00e1 una solicitud no v\u00e1lida y El respondedor lo dejar\u00e1 caer silenciosamente. Luego, el respondedor espera un nuevo paquete de solicitud. El commit 689c5421bfe0 (\"RDMA/rxe: corregir la verificaci\u00f3n incorrecta de la longitud del respondedor\") pospone la verificaci\u00f3n de la longitud del respondedor para los QP de UD en la funci\u00f3n `copy_data`. Pero introduce un problema de regresi\u00f3n para los QP de UD. Cuando el tama\u00f1o del paquete es demasiado grande para caber en el b\u00fafer de recepci\u00f3n. `copy_data` devolver\u00e1 el c\u00f3digo de error -EINVAL. Entonces `send_data_in` devolver\u00e1 RESPST_ERR_MALFORMED_WQE. UD QP pasar\u00e1 al estado ERROR."}], "id": "CVE-2024-40992", "lastModified": "2024-07-12T16:34:58.687", "metrics": {}, "published": "2024-07-12T13:15:20.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: RDMA/rxe: Fix responder length checking for UD request packets", "id": "2297576", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297576"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/rxe: Fix responder length checking for UD request packets\nAccording to the IBA specification:\nIf a UD request packet is detected with an invalid length, the request\nshall be an invalid request and it shall be silently dropped by\nthe responder. The responder then waits for a new request packet.\ncommit 689c5421bfe0 (\"RDMA/rxe: Fix incorrect responder length checking\")\ndefers responder length check for UD QPs in function `copy_data`.\nBut it introduces a regression issue for UD QPs.\nWhen the packet size is too large to fit in the receive buffer.\n`copy_data` will return error code -EINVAL. Then `send_data_in`\nwill return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into\nERROR state."], "name": "CVE-2024-40992", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40992\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40992\nhttps://lore.kernel.org/linux-cve-announce/2024071250-CVE-2024-40992-6554@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 6.6.36, kernel 6.9.7, kernel 6.10-rc5"}